Eleven people from the US, China and three former Soviet republics have been charge with stealing more than 40 million credit and debit card numbers and selling them to criminals in the US and Europe, in one of the largest identity theft schemes on record.

The indictments mark the end of a three-year investigation involving law enforcement authorities from at least four countries. US attorney general Michael Mukasey said the financial toll in the case is "impossible to quantify at this point".

Michael Sullivan, a justice department lawyer, said that most of the victims were in the US but officials have yet to identify all those whose credit card numbers were stolen. "I suspect that a lot of people are unaware that their identifying information has been compromised," he said.

One of the companies thought to have been targeted, TJX, is the parent of the British retail chain TK Maxx. In January, TJX admitted that information from 45.7 million credit and debit cards on both sides of the Atlantic had been stolen. Names, card numbers and personal data were stolen over a 17-month period and covering transactions dating as far back as December 2002.

According to justice department officials and court documents, members of the ring drove close to US retail stores in search of wireless internet connections on which they installed "sniffer" software that would record card numbers.

The suspects then sold the numbers over the internet to individuals who encoded them on blank credit cards and withdrew tens of thousands of dollars at a time from cash machines.

According to court documents unsealed this week, three of the defendants, Sergey Pavlovich of Belarus, and Dzmitry Burak and Sergey Storchak of Ukraine, used a website on which credit card traffickers bought and sold data, with Pavlovich taking a percentage of the sales.

Two other defendants, Maksym Yastremskiy of Kharkov, Ukraine, and Aleksandr Suvorov of Sillamae, Estonia, known on the internet as JonnyHell, allegedly captured credit and debit card numbers from a New York restaurant. Justice officials said Yastremskiy pocketed more than $11m from the sale of the stolen numbers.

One of the defendants, Albert Gonzalez of Miami, was an informant for the US Secret Service, the agency tasked with protecting the US president and combating financial fraud and counterfeiting. Gonzalez faces life in prison if convicted on all charges.